PWS_ W911RX-21-Q-0007.pdf

Performance Work Statement Irwin Army Community Hospital HIPAA-Compliant Electronic Communication

Exchange Capability (E-CEC)

1. General. The Irwin Army Community Hospital (IACH) requires global desktop computer electronic communication capabilities that are Health Insurance Portability Accountability Act (HIPAA) compliant as required by public law and National Institute of Standards and Technology (NIST) certified. This requirement is in support of our referral management needs to communicate and provide data/clinical information between our military treatment facility (MTF) and the Military Health Systems’ (MHS) global TRICARE regional contractors and their network civilian providers. The system shall be secure, i.e. able to function across the internet, military network, and the MHS’ two TRICARE regional contractors systems, with a level of security encryption that meets the requirements in section 3, Technical Requirements. The system must be simple to use, requiring no Government or TRICARE regional contractor maintenance or support staff. Communications currently include facsimiles and emails with and without attachments. Technological advances over the life of the contract may result in additional communication venues. The life of the contract will be a base year with an additional four option years. The Government may add additional venues to the support requirement. The communication documents are to be handled at all levels as originals or digital image representations of the original paper or computer generated documents or pages, thus eliminating the need to create, process, transmit, and store paper documents. This contractual arrangement forms a "business associate agreement" between the Government and the electronic communication service contractor (business associate) as it pertains to the handling of protected health information (PHI) governed by the HIPAA. This relationship is further defined at http://www.tricare.mil/tmaprivacy/contract.cfm

1.1. Scope of Work. The principle objective of the E-CEC performance work statement (PWS) is to provide IACH with secure, HIPAA-compliant electronic communication capability to send and receive referral management related communication data and documents. Required quantities of sites using the E- CEC and in-bound and out-bound activity are estimated, and subject to adjustment.

1.2. The Government requires that the current electronic communication operating system and “facsimile” numbers (numeric combination used to submit and receive documents) be retained. The Government email addresses, facsimile numbers, and underlying electronic infrastructure will be utilized without revision in the performance of this service. The current system in use is a secure communication/e-mail system built on a Solaris Enterprise Service Bus with a web-based AJAX-enabled user interface.

1.2.1. This electronic communication capability shall ensure that Government MTFs can electronically send and receive correspondence, data and documents without the use of stand-alone, standard manual communication hardware.

Generally, the majority of electronic communications will occur between the Government MTF and TRICARE regional contractors, including their associated network health care providers' offices. This does not, however, limit the requirement to provide electronic communication services between the MTF and other locations. The requirement includes the ability to communicate with any party reachable via facsimile or email transmission. Email transmissions may or may not include attachments.

1.2.2. The Government requires flexibility in the quantity, establishment, termination and relocation or reassignment of electronic communication accounts. The government anticipates the number of users and or the number of faxes could increase or decrease based on future Army realignment. Defined scope is an estimate only subject to potential modification or realignment between each period of performance.

1.2.3. The government requires timely responsiveness to requests for additional accounts, changes to accounts, and termination of accounts. Accounts shall be assigned to individual users at the MTF. The Contracting Officer’s Representative (COR) will initiate or approve all requests.

1.3. Place of Performance. Government facilities will not be provided.

1.4. Hours of Operation and Technical Support. Electronic communication capability and associated off-site equipment must be functional a minimum of 12 hours per day, 365 days per year between 6:30 AM and 6:30 PM in each local time-zone except for scheduled down times for system maintenance, upgrade or repair. Any scheduled down time for system maintenance, upgrade, or repair must be performed on weekends and take into account the global nature of the contracted services. Friday evenings, after 2000 hours, in central time zone through Monday morning, 0600 hours. All scheduled down time must be pre-communicated to the Government at least 48 hours in advance, and the Government must be provided notification of unscheduled down time during non-weekend hours (as defined herein) immediately, but no later than 60 minutes after the incident or initial non-availability. The contractor shall notify the COR and a list of designated Points of Contact (POCs) as identified by the Government. Contractor technical support staff must be available to answer questions, provide help desk support, and trouble-shoot system problems Monday-Friday during the period 7:30 am to 4:30 pm in the following local time-zone Central.

1.5. Performance Quality. The contractor shall establish and maintain a Quality

Control system that shall ensure the requirements of the contract are provided as specified in section C.3 of the statement of work.

1.6. Phase In / Phase Out. To minimize any decrease in services and to prevent possible negative impacts on additional services, the Contractor shall work with any predecessor or subsequent awardee (contractor) to ensure a seamless transition between contractors for up to 90 days. During the phase in period, the Contractor shall become familiar with contract requirements in order to commence full performance of services on the contract start date. The “facsimile” numbers will be retained for use by the Government, and will be transferred between incumbent and successor contractors as required.

2. Contractor - Furnished Equipment, Materials and Services. The contractor shall provide all the necessary equipment to provide HIPAA-compliant electronic communication functions. The contractor is not responsible to provide Government or non-Government user equipment (desk top computers, facsimile machines, etc.)

3. Technical Requirements. The electronic communication solution shall:

3.1. Be web-enabled and meet Department of Defense (DoD), Military Health System (MHS), Defense Health Agency HIPAA and security requirements;

3.1.2. Be validated under the National Institute of Standards and Technology (NIST)

Cryptographic Module Validation Program (CMVP) that, at a minimum, meets level 2 security requirements of the Federal Information Processing Standard 140–2 (FIPS 140–2) for a Secure Sockets Layer (SSL) architecture;

3.1.3. Provide a secure, encrypted end-to-end connection supported by authentication and server SSL certification;

3.1.4. Support https and http, and Virtual Private Network (VPN) configurations;

3.1.5. Support Lightweight Directory Access Protocol (LDAP) in accordance with

(IAW) DHA / MHS requirements;

3.1.6. Be compliant with section 508 of the Rehabilitation Act of 1973, as amended

(29 U.S.C. 794d);

3.1.7. Ensure data encryption during data transmission and storage of PHI data outside of source system IAW MHS PHI data management and HIPAA requirements;

3.1.8. Have the ability to audit capability IAW Evaluation Assurance Level - 3

(EAL3);

3.1.9. Support interactive, batch and scheduled communication;

3.1.10. Be Windows 10 or higher and XP/VISTA/Windows 10/CREDANT compatible and operate with the following web browsers: Microsoft Edge (included with Windows 10 Build 1909 or higher), Internet Explorer 11 and higher, Mozilla Firefox 68.11.0 or higher and Google Chrome 84.0.4147.125 or higher. If any software to be installed on a server, it must be Microsoft server 2016 and 2019 complaint.

3.1.11. Have and utilize communication number portability capability;

3.1.12. Measure the time required to transmit communication messages by minutes and seconds; and

3.1.13. Support and provide 10GB of storage capability for each account / mailbox.

3.2. Super User Account. A super user account will be provided to IACH.

Additional Super User accounts will be available upon request by the COR.

Super Users shall have the ability/capability to manage and audit accounts, and reset passwords for surrogate and satellite accounts. Super Users will have the capability to allow user access to each account. Super Users will also have the capability to allow oversight of multiple accounts.

4. Functional Requirements. The electronic fax solution shall meet the following functional requirements.

4.1. Users shall be capable of sending and retrieving electronic communications from their Internet connected computer workstation.

4.1.2. The electronic communication solution shall seamlessly send and receive a variety of electronic or digital file types to include the following: doc, docx, .txt, xls, pdf, tif, and jpg including scanned documents. The solution must support the inclusion of multiple types of electronic or digital documents (files) as attachments for any single communication submitted via either, facsimile or email.

4.1.3. The solution shall provide the capability of converting any in-coming file to a

Portable Document Format (pdf) document, and of storing the resultant pdf document.

4.1.4. Digital images or attached email files stored on the Contractor’s internet accessible program or system shall be protected from unauthorized use or viewing in compliance with HIPAA.

4.1.5. Digital images or attached email files stored on the Contractor’s internet accessible program or system shall be completely eradicated when sent or received from non-workstation accounts and or internet servers used to transmit the send and or receive. Complete eradication means that the images cannot be restored from the Contractor’s program or system.

4.1.5. Each communication action shall be documented in compliance with HIPAA.

The log shall provide identification of the individual account from which the communication was sent, identification of the individual account to which the communication was sent, the time sent and received, the size of the document, and the number of pages. The contractor shall provide a periodic consolidation of communication action documentation to the COR upon request.

4.1.6. A work order system to receive, track and resolve access, availability, and performance problems or issues will be utilized and available for review by the COR and Government assigned POCs (estimated at 5 additional POCs).

5. Privacy of Protected Health Information. In accordance with DoD 6025.18-R “Department of Defense Health Information Privacy Regulation,” January 24, 2003, the Contractor meets the definition of Business Associate. Therefore, a Business Associate Agreement is required to comply with both the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security regulations. This clause serves as that agreement whereby the Contractor agrees to abide by all applicable HIPAA Privacy and Security requirements regarding health information as defined in this clause, and in DoD 6025.18-R and DoD 8580.02-R, as amended. Additional requirements will be addressed when implemented.

5.1. Definitions. As used in this clause generally refer to the Code of Federal Regulations (CFR) definition unless a more specific provision exists in DoD 6025.18-R or DoD 8580.02-R.

5.1.2. Individual has the same meaning as the term "individual" in 45 Code of

Federal Regulations (CFR) 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

5.1.3. Privacy Rule means the Standards for Privacy of Individually Identifiable

Health Information at 45 CFR part 160 and part 164, subparts A and E.

5.1.4. Protected Health Information has the same meaning as the term "protected health information" in 45 CFR 160.103, limited to the information created or received by the contractor from or on behalf of the Government pursuant to the Contract.

5.1.5. Electronic Protected Health Information has the same meaning as the term

“electronic protected health information” in 45 CFR 160.103.

5.1.6. Required by Law has the same meaning as the term "required by law" in 45

CFR 164.103.

5.1.7. Security Rule means the Health Insurance Reform: Security Standards at 45

CFR part 160, 162 and part 164, subpart C.

5.1.8. Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 CFR 160.103 and 160.502, 164.103, 164, 304, and 164.501.

5.2. The contractor shall not use or further disclose Protected Health Information other than as permitted or required by the contract or as required by law.

5.3. The contractor shall use safeguards to prevent use or disclosure of the

Protected Health Information other than as provided for by this contract.

5.3.1. The contractor agrees to use administrative, physical, and technical safeguards that protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits in the execution of this contract.

5.4. The contractor shall, at their own expense, take action to mitigate, to the extent practicable, any harmful effect that is known to the contractor of a use or disclosure of Protected Health Information by the contractor in violation of the requirements of this contract. These mitigation actions will include as a minimum those listed in the OTSG/MEDCOM Policy Memo 13-057, Personally Identifiable Information (PII), Incident Reporting and Notification procedure, which is available at: http://www.tricare.mil/tmaprivacy/breach.cfm

5.5. The contractor shall report to the Government any security incident involving

Protected Health Information of which it becomes aware within 48 hours of incident.

5.6. The contractor shall report to the Government any use or disclosure of the

Protected Health Information not provided for by this contract of which the contractor becomes aware within 48 hours.

5.7. The contractor shall ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by the contractor on behalf of the Government, agrees to the same restrictions and conditions that apply through this contract to the contractor with respect to such information.

5.8. The contractor shall ensure that any agent, including a subcontractor, to whom it provides electronic Protected Health Information, agrees to implement safeguards to protect it.

5.9. The contractor shall provide access, at the request of the Government, and in the time and manner designated by the Government to Protected Health Information in a Designated Record Set, to the Government or, as directed by the Government, to an Individual in order to meet the requirements under 45 CFR 164.524.

5.10. The contractor shall make any amendment(s) to Protected Health Information in a Designated Record Set that the Government directs or agrees to pursuant to 45 CFR 164.526 at the request of the Government, and in the time and manner reasonably designated by the Government.

5.11. The contractor shall make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by the contractor on behalf of, the Government, available to the Government.

5.12. The contractor shall document such disclosures of Protected Health

Information and information related to such disclosures as would be required for the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

5.13. The contractor shall provide to the Government or an Individual, in time and manner designated by the Government, information collected in accordance with this Clause of the Contract, to permit the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

5.14. General Use and Disclosure Provisions. Except as otherwise limited in this

Agreement, the contractor may use or disclose Protected Health Information on behalf of, or to provide services to, the Government for the following purposes, if such use or disclosure of Protected Health Information would not violate the Privacy Rule or the Department of Defense Health Information Privacy Regulation if done by the Government: correct technical issues/difficulties associated with the transfer of PHI via electronic communication between the sending and receiving parties.

5.14.1. Except as otherwise limited in this Agreement, the contractor may use

Protected Health Information for the proper management and administration of the contractor or to carry out the legal responsibilities of the contractor.

5.14.2. Except as otherwise limited in this Agreement, the contractor may disclose

Protected Health Information for the proper management and administration of the contractor, provided that disclosures are required by law, or the contractor obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person and the person notifies the contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

5.15.3. Except as otherwise limited in this Agreement, the contractor may use Protected Health Information to provide Data Aggregation services to the Government as permitted by 45 CFR 164.504(e)(2)(i)(B).

5.15.4. Contractor may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR 164.502(j)(1).

5.16. Obligations of the Government. Provisions for the Government to inform the contractor (business associate) of Privacy Practices and Restrictions

5.16.1. Upon request the Government shall provide the contractor with the notice of privacy practices that the Government produces in accordance with 45 CFR 164.520, as well as any changes to such notice.

5.16.2. The Government shall provide the contractor with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect the contractor’s permitted or required uses and disclosures.

5.16.3. The Government shall notify the contractor of any restriction to the use or disclosure of Protected Health Information that the Government has agreed to in accordance with 45 CFR 164.522.

5.17. Permissible Requests by the Government. The Government shall not request the contractor to use or disclose Protected Health Information in any manner that would not be permissible under the HIPAA Privacy Rule, the HIPAA Security Rule, or any applicable Government regulations (including without limitation, DoD 6025.18-R and DoD 8580.02-R) if done by the Government, except for providing Data Aggregation services to the Government and for management and administrative activities of the contractor (business associate) as otherwise permitted by this clause.

5.18. Termination. A breach by the contractor of this clause, may subject the contractor to termination under any applicable default or termination provision of this contract.

5.19. Effect of Termination. If this contract has records management requirements, the records subject to the Clause should be handled in accordance with the records management requirements. If this contract does not have records management requirements, the records should be handled in accordance with sub-paragraphs (C.5.16.2.2.) and (C.5.16.2.3.) below:

5.19.1. If this contract does not have records management requirements, except as provided in sub-paragraph (C.5.16.2.3.) of this section, upon termination of this contract, for any reason, the contractor shall destroy all Protected Health

Information received from the Government, or created or received by the contractor on behalf of the Government. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of the contractor. The contractor shall retain no copies of the Protected Health Information.

5.19.2. If this contract does not have records management provisions and the contractor determines that destroying the Protected Health Information is infeasible, the contractor shall provide to the Government notification of the conditions that make destruction infeasible. Upon mutual agreement of the Government and the contractor that destruction of Protected Health Information is infeasible, the contractor shall extend the protections of this contract to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the destruction infeasible, for so long as the contractor maintains such Protected Health Information.

5.20. Regulatory References. A reference in this Clause to a section in DoD

6025.18-R, DoD 8580.02-R, Privacy Rule or Security Rule means the section currently in effect or as amended, and for which compliance is required.

5.21. Survival. The respective rights and obligations of Business Associate under the "Effect of Termination" provision of this Clause shall survive the termination of this contract.

5.21. Interpretation. Any ambiguity in this Clause shall be resolved in favor of a meaning that permits the Government to comply with the Privacy Rule.

C.6. Invoicing / Billing.

6.1. The contractor shall identify the contract number, task order number, quantity, unit price, and period of performance on each invoice.

6.2. The contractor shall invoice by CLIN.

6.2.1. Each CLIN will be defined by requiring organization.

6.3. The contractor shall provide the electronic capability for viewing, downloading, and printing of invoice detail including an itemization of services by location and individual account.

6.3.1. Location identification will include the four digit Defense Medical Identification

System (DMIS) Code with the facility name.

6.4. The contractor shall submit payment request using the Wide Area Work Flow

(WAWF). Questions concerning monthly payments should be directed to the

Defense Finance and Accounting Services (DFAS) - Rome, ATTN: ROVP, 325 Brooks Road, Rome, NY 13441-4527 at 1-800-553-0527 or faxed to 1-877-575- 3332 (ATTN: Vendor Pay – Rome). Rome is providing help support to DFAS Indianapolis for this purpose.

6.5. The contractor shall provide email notification to the Contracting Officer’s

Representative (COR) when an invoice is submitted.

6.6. Payment Status Information. To obtain information about payments due or late payments, go to http://www.dfas.mil/, click on Vendor Pay Inquiry System, then Query by Contract Number. Type the purchase/delivery order number

(provided on the SF1449 in Block 2) without dashes and hit enter. This site will provide invoice information, receiving report information, payment date, date paid, etc. When there is no information concerning the invoice or receiving report, this indicates that the invoice/receiving report has not been received and the documents need to be sent prior to payment. In this case, for receiving reports, contact the Point of Contact located directly above this paragraph. If there is no visible information about the invoice submitted resend the invoice to the DFAS office located in Block 18a of the purchase/delivery order.

6.7. Government personnel. Procedures must be followed in order for DFAS to accept the receiving report are outlined below. Failure to follow these procedures will result in DFAS rejection of the acceptance document and possible interest charges paid by your organization.

6.8.1. Receiving reports. The Requiring Activity's Authorized Representative shall, within five calendar days after receipt of supplies and services, follow the instructions below regarding a SF Form 1449 ensuring that all signatures are legible and include the date, office symbol, and telephone number.

6.8.2. Forward-completed SF Form 1449 to the appropriate DFAS contract administration office and retain a copy for your records.

6.8.3. Delivery of the item(s) identified shall be made by the date specified in the

Schedule to the address shown in Block 15.

6.8.4. In Block 32a (check-mark in received/accepted blocks); Block 32b (printed name, telephone number, title, and signature) of official authorized to accept supplies/services; Block 32c, (date supplies/services accepted); Block 33 (check-mark for either partial or final); Block 42a (printed name of receiver); and Block 42c (date supplies or services received).

7. Deliverables.

http://www.dfas.mil/

7.1. Accounting for Contract Services. The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the contractor will report ALL contractor manpower

(including subcontractor manpower) required for performance of this contract.

The contractor is required to completely fill in all the information in the format using the following web address https://cmra.army.mil/. The required information includes:

7.1.2. Contracting Office, Contracting Officer, Contracting Officer’s Technical

Representative;

7.1.3. Contract number, including task and delivery order number;

7.1.4. Beginning and ending dates covered by reporting period;

7.1.5. Contractor name, address, phone number, e-mail address, identity of contractor employee entering data;

7.1.6. Estimated direct labor hours (including sub-contractor);

7.1.7. Estimated direct labor dollars paid this reporting period (including sub-contractor);

7.1.8. Total payments (including sub-contractor);

7.1.9. Predominant Federal Service Code (FSC) reflecting services provided by contractor (and separate predominant FSC for each sub-contractor if different);

7.1.10. Organizational title associated with the Unit Identification Code (UIC) for the

Army Requiring Activity (the Army Requiring Activity is responsible for providing the contractor with its UIC for the purposes of reporting this information);

7.1.11. Locations where contractor and sub-contractors perform the work (specified by zip code in the United States and nearest City, Country, when in an overseas location, using standardized nomenclature provided on website);

7.1.12. Presence of deployment or contingency contract language, and,

7.1.13. Number of contractor and sub-contractor employees deployed in theater this reporting period (by country).

7.1.14. As part of its submission, the contractor will also provide the estimated total cost (if any) incurred to comply with this reporting requirement.

7.2. Reporting period will be the period of performance not to exceed 12 months ending September 30 of each government fiscal year and must be reported by 31 https://cmra.army.mil/

October of each calendar year. The contractor shall notify the Contracting

Officer’s Representative (COR) by the 5th working day of November whether or not they have completed this report. If the COR is unavailable, the contractor will notify the Contracting Officer.

8. Applicable Publications and Documents

45 CFR Parts 160 and 164 (Standards for Privacy of Individually Identifiable Health Information) Clinger-Cohen Act of 1996 (PL 104-106) Health Information Portability and Accountability Act (PL 104-199) IRS Code of 1986 Social Security Act Medicare/Medicaid Joint Technical Architecture Compliant Defense Information Infrastructure Common Operating Environment (DIICOE)

DODD 6025.18-R

(DoD Health Information Privacy Regulation) DODD 8000.1, Management of DOD Information Resources and Information Technology.

DODD 5000.2, Operation of the Defense Acquisition System.

DODD 8190.3 Smart Card Technology Army Regulation 25-1, Army Information Management.

Army Regulation 25-2, Information Assurance Army Regulation 70-1, Army Acquisition Policy

The Point of Contact for this request is:

Contracting Officer Representative (COR)

Beth Hughes

785-2397262